@apexops/cli 0.10.0-next.3 → 0.10.0-next.5

package/README.md

@@ -0,0 +1,40 @@
+# @apexops/cli
+
+APEX vNext command-line interface and local MCP server for governed Azure
+platform engineering workflows.
+
+## Install
+
+```bash
+npm install @apexops/cli
+```
+
+## Quick Start
+
+From a consumer workspace:
+
+```bash
+npx apex init --project my-workload
+npx apex status --json
+```
+
+Use `npx apex` rather than relying on a globally installed `apex` binary.
+
+## Copilot Clients
+
+The CLI installs managed APEX agents, skills, instructions, and MCP
+configuration for supported GitHub Copilot clients.
+
+```bash
+npx apex update
+```
+
+## Documentation
+
+- [APEX vNext repository](https://github.com/jonathan-vella/apex-vnext)
+- [CLI reference](https://apexops.pro/reference/cli/)
+- [First run tutorial](https://apexops.pro/tutorials/first-run/)
+
+## License
+
+MIT.

package/assets/client-projection-metadata/copilot-cli-agent-tools.json

@@ -44,11 +44,17 @@
     "apex/projectList",
     "apex/projectUse",
     "apex/projectDelete",
+    "apex/gateDecide",
     "apex/stageArtifact",
     "apex/stageFile",
     "apex/generateIac",
     "apex/validateTask",
     "apex/completeTask",
+    "apex/requirementsComplete",
+    "apex/architectureComplete",
+    "apex/reviewComplete",
+    "apex/reviewDecide",
+    "apex/planComplete",
     "apex/preview",
     "apex/reconcile",
     "apex/inventory",
@@ -72,11 +78,17 @@
     "projectList",
     "projectUse",
     "projectDelete",
+    "gateDecide",
     "stageArtifact",
     "stageFile",
     "generateIac",
     "validateTask",
     "completeTask",
+    "requirementsComplete",
+    "architectureComplete",
+    "reviewComplete",
+    "reviewDecide",
+    "planComplete",
     "preview",
     "reconcile",
     "inventory",

package/assets/client-projections/github-copilot-cli/.github/agents/apex-architect.agent.md

@@ -12,8 +12,9 @@ tools:
   - apex/nextTask
   - apex/recordInput
   - apex/taskContext
-  - apex/stageArtifact
-  - apex/completeTask
+  - apex/architectureComplete
+  - apex/reviewDecide
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -49,14 +50,14 @@ Gate 2 package without bypassing the kernel's decision or approval boundaries.
   user confirmation before recording the final Architecture decision.
 5. Use current ARM MCP pricing evidence for every cost line item. If current evidence is unavailable, record the
   unavailability and block the cost posture from being treated as confirmed; never invent prices or currency values.
-6. Stage `architecture`, `cost-estimate`, and `workload-decision-manifest`, then submit all three once through
-  `apex/completeTask` with `outputs`. Do not submit a single-output completion.
+6. Submit `architecture`, `cost-estimate`, and `workload-decision-manifest` atomically through
+  `apex/architectureComplete`.
 7. APEX materializes a read-only Gate 2 package at `agent-output/<project>/<run>/architecture/`. Report the package,
   including `architecture-assessment.md`, `cost-estimate.md`, `sku-comparison.md`, and `challenger-findings.md`.
-8. When the kernel issues `architecture-review`, delegate the exact task to `APEX Reviewer`. Present every challenger
-  finding and use targeted decision follow-ups for findings the user chooses to resolve. Findings must be remediated,
-  accepted with rationale, or explicitly deferred before Gate 2 can open.
-9. Gate 2 remains a human terminal ceremony after the user reviews the full evidence appendix; never approve it.
+8. When the kernel issues `architecture-review`, delegate the exact task to `APEX Reviewer`. Present returned findings
+  in one native decision panel and submit permitted decisions through `apex/reviewDecide`.
+9. After the user reviews the full evidence appendix, ask one explicit Proceed/Revise question. Only after Proceed,
+  call `apex/gateDecide` for Gate 2 with `confirm: true`, then use the Planning handoff.
 
 Read `.github/skills/apex-architecture/SKILL.md` when architecture guidance is needed.
 Read `.github/skills/apex-azure-defaults/SKILL.md` only for projected defaults, governance, security, naming, or AVM rules.

package/assets/client-projections/github-copilot-cli/.github/agents/apex-planner.agent.md

@@ -11,8 +11,9 @@ tools:
   - apex/status
   - apex/nextTask
   - apex/taskContext
-  - apex/stageArtifact
-  - apex/completeTask
+  - apex/planComplete
+  - apex/reviewDecide
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -45,14 +46,16 @@ Gate 3.
   secret reference must include `kind`, `provider`, and `reference`.
 4. Explain logical resources, dependencies, controls, implementation bindings, environment inputs, and rollback or
   validation risks. Ask targeted follow-ups only for unresolved user-owned choices; never infer secret values.
-5. Stage `implementation-intent` first. Use its returned hash as `iac-binding.intentHash`, then stage the binding and
-  environment inputs. Complete the plan once through `apex/completeTask` with all three artifacts in `outputs`; do
-  not submit a single-output completion.
+5. Complete plans through `apex/planComplete` with the implementation intent, binding without `intentHash`, and
+  environment inputs. The kernel derives the canonical intent hash and atomically validates all three outputs. Do not
+  call `apex/completeTask` with a partial plan bundle or a placeholder `intentHash`.
 6. APEX materializes a read-only Gate 3 package at `agent-output/<project>/<run>/plan/`. Report
   `implementation-plan.md`, `iac-binding.md`, `environment-inputs.md`, and `challenger-findings.md` for human review.
-7. When the kernel issues `plan-review`, delegate the exact task to `APEX Reviewer`. Present findings and use targeted
-  follow-ups for decisions the user elects to revise. Gate 3 remains a human terminal ceremony.
-8. Invoke `APEX CodeGen`, `APEX Reviewer`, or `APEX Validator` only for an explicit worker task in the envelope.
+7. When the kernel issues `plan-review`, delegate the exact task to `APEX Reviewer`. Present findings in one native
+  decision panel and submit permitted decisions through `apex/reviewDecide`.
+8. Ask one explicit Proceed/Revise question after review. Only after Proceed, call `apex/gateDecide` for Gate 3 with
+  `confirm: true`, then use the Operations handoff.
+9. Invoke `APEX CodeGen`, `APEX Reviewer`, or `APEX Validator` only for an explicit worker task in the envelope.
 
 Read `.github/skills/apex-planning/SKILL.md` when planning guidance is needed.
 Load the codegen skill only in a CodeGen worker context.

package/assets/client-projections/github-copilot-cli/.github/agents/apex-requirements.agent.md

@@ -12,8 +12,9 @@ tools:
   - apex/nextTask
   - apex/recordInput
   - apex/taskContext
-  - apex/stageArtifact
-  - apex/completeTask
+  - apex/requirementsComplete
+  - apex/reviewDecide
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -39,12 +40,16 @@ candidate Azure services without deciding architecture, and produces a human-rev
 
 # Success criteria
 
-1. Call `apex/status`, then loop on `apex/nextTask` until it returns `status=task`.
+1. Extract facts already supplied in the user's opening description. Call `apex/status`, then loop on `apex/nextTask`
+  until it returns `status=task`. Present matching supplied facts as recommended confirmations; do not make the user
+  retype them and do not record them before confirmation.
 2. For every `status=needs_input`, do not call `apex/taskContext`. Use earlier recorded answers to frame the returned
   questions, identify contradictions, and explain the consequence of material choices. Ask every returned question,
   batching independent questions through the active client mechanism. Render `options` as native single-select or
-  multi-select controls without adding or reordering kernel options. For `data-classification` and `compliance`, convert
-  selections to their required typed value. Record explicit deferrals and unknowns as their matching typed values.
+  multi-select controls without adding or reordering kernel options. When a question includes `recommendation`, mark
+  its matching option or options as recommended and show the rationale; never record it until the user confirms or
+  overrides it. For `data-classification` and `compliance`, convert selections to their required typed value. Record
+  explicit deferrals and unknowns as their matching typed values.
 3. Treat Azure services as candidates: recommend viable compute, data, integration, identity, and observability options
   with a concise fit and trade-off rationale, but never record a service or SKU as an Architecture decision. Capture
   user SKU constraints or an explicit no-preference position; Architecture owns final service and SKU selection.
@@ -56,13 +61,19 @@ candidate Azure services without deciding architecture, and produces a human-rev
   required fields. Populate the typed review fields with business context, measurable success criteria, non-functional
   requirements, security/compliance posture, budget/operations posture, regional constraints, and candidate-service
   rationale for Architecture.
-7. Stage and submit the typed requirements artifact. APEX materializes read-only review projections at
-  `agent-output/<project>/<run>/`; report those paths and their artifact hash, but do not edit the generated files.
-8. When the kernel issues `requirements-review`, delegate the exact task to `APEX Reviewer`. Present every returned
-  completeness or contradiction finding, then use targeted follow-up questions only for findings the user chooses to
-  resolve. Findings must be remediated, accepted with rationale, or explicitly deferred before Gate 1 can open.
-9. When review completes, direct the user to review `01-requirements.md`, `README.md`, `service-recommendations.md`,
-  `sku-preferences.md`, and `challenger-findings.md`. Gate 1 remains a human terminal ceremony; never approve it.
+7. Submit the typed requirements artifact through `apex/requirementsComplete`. APEX materializes read-only review
+  projections at `agent-output/<project>/<run>/`; report those paths and their artifact hash, but do not edit the
+  generated files.
+8. Immediately call `apex/nextTask` after submitting requirements. In VS Code, when it returns the
+  `requirements-review` task, invoke `APEX Reviewer` through the `agent` tool with exactly that task context; do not
+  wait for the user to request the challenge. In a client without the Reviewer worker, report the exact pending review
+  task and do not claim the challenge ran.
+9. When `apex/nextTask` returns `needs_review`, present every finding in one native decision panel. Submit the complete
+  decision set through `apex/reviewDecide`. A revision must produce a new Requirements artifact and fresh review;
+  risk acceptance requires the rationale and future expiry requested by APEX.
+10. When review completes, direct the user to review `01-requirements.md`, `README.md`, `service-recommendations.md`,
+  `sku-preferences.md`, and `challenger-findings.md`. Ask one explicit Proceed/Revise question. Only after the user
+  chooses Proceed, call `apex/gateDecide` for Gate 1 with `confirm: true`, then use the Architecture handoff.
 
 Do not read repository files to discover artifact schemas; `apex/taskContext` is the complete output contract for this
 MCP-only role. Read `.github/skills/apex-azure-defaults/SKILL.md` only when the kernel asks for a region, compliance,

package/assets/client-projections/github-copilot-cli/.github/agents/apex.agent.md

@@ -13,6 +13,7 @@ tools:
   - apex/projectList
   - apex/projectUse
   - apex/projectDelete
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -69,6 +70,9 @@ Coordinate APEX without authoring project artifacts or inferring workflow state.
   `apex gate decide --gate <N> --decision <approved|rejected> --actor <USER_ID> --json`. At Gate 4, also require
   review of the exact preview, target, expiry, and approval recipient before directing
   `apex gate decide --gate 4 --decision <approved|rejected> --actor <USER_ID> --recipient <RECIPIENT_ID> --json`.
+9. When the user explicitly says `approve Gate 1`, `approve Gate 2`, `approve Gate 3`, or the equivalent rejection,
+  call `apex/gateDecide` with that gate, decision, and `confirm: true`. The operation derives the actor from the local
+  OS username. Do not use it for Gate 4, and do not infer confirmation from an ambiguous message.
 
 Use the active client projection's question mechanism only for project creation or kernel-owned routing choices. Read
 `.github/skills/apex-workflow/SKILL.md` only when status, resume, or project selection needs more guidance.

package/assets/client-projections/github-copilot-cli/.github/mcp.json

@@ -11,16 +11,23 @@
         "capabilityStatus",
         "nextTask",
         "taskContext",
+        "readTaskInput",
         "recordInput",
         "projectCreate",
         "projectList",
         "projectUse",
         "projectDelete",
+        "gateDecide",
+        "reviewDecide",
         "stageArtifact",
         "stageFile",
         "generateIac",
         "validateTask",
         "completeTask",
+        "requirementsComplete",
+        "architectureComplete",
+        "reviewComplete",
+        "planComplete",
         "preview",
         "reconcile",
         "inventory",

package/assets/client-projections/github-copilot-cli/.github/skills/apex-requirements/SKILL.md

@@ -24,10 +24,13 @@ Use this skill only for an active requirements task.
 4. Submit that request only through `apex/recordInput`, preserving its request ID, expected journal head, and owner
    epoch.
 5. Call `apex/nextTask` again and repeat until it returns a requirements `task`; only then read `apex/taskContext`.
-6. Treat the service-preferences round as a preference boundary. Capture retained, prohibited, and preferred services,
-   SKU preferences, and environment overrides without selecting architecture, SKUs, or implementation details.
-7. Stage the task-context-defined requirements output, complete the requirements task, and wait for the required review
-   result before reporting that Gate 1 is ready. Only the kernel opens or evaluates Gate 1.
+6. Treat service questions in the workload panel as a preference boundary. Present the kernel recommendation, then
+   capture retained, prohibited, and preferred services, SKU preferences, and environment overrides without selecting
+   architecture, SKUs, or implementation details.
+7. Submit the task-context-defined output through `apex/requirementsComplete`, invoke the required Reviewer, and handle
+   `needs_review` through one native findings panel and `apex/reviewDecide`.
+8. After a clean or fully dispositioned review, ask for explicit Gate 1 approval. Call `apex/gateDecide` only after the
+   user chooses Proceed, then continue to Architecture in the same turn.
 
 The kernel catalog and its versioned input contracts are authoritative. Do not choose architecture, SKUs, or
 implementation details while gathering requirements.

package/assets/client-projections/github-copilot-vscode/.github/agents/apex-architect.agent.md

@@ -12,8 +12,9 @@ tools:
   - apex/nextTask
   - apex/recordInput
   - apex/taskContext
-  - apex/stageArtifact
-  - apex/completeTask
+  - apex/architectureComplete
+  - apex/reviewDecide
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -58,14 +59,14 @@ Gate 2 package without bypassing the kernel's decision or approval boundaries.
   user confirmation before recording the final Architecture decision.
 5. Use current ARM MCP pricing evidence for every cost line item. If current evidence is unavailable, record the
   unavailability and block the cost posture from being treated as confirmed; never invent prices or currency values.
-6. Stage `architecture`, `cost-estimate`, and `workload-decision-manifest`, then submit all three once through
-  `apex/completeTask` with `outputs`. Do not submit a single-output completion.
+6. Submit `architecture`, `cost-estimate`, and `workload-decision-manifest` atomically through
+  `apex/architectureComplete`.
 7. APEX materializes a read-only Gate 2 package at `agent-output/<project>/<run>/architecture/`. Report the package,
   including `architecture-assessment.md`, `cost-estimate.md`, `sku-comparison.md`, and `challenger-findings.md`.
-8. When the kernel issues `architecture-review`, delegate the exact task to `APEX Reviewer`. Present every challenger
-  finding and use targeted decision follow-ups for findings the user chooses to resolve. Findings must be remediated,
-  accepted with rationale, or explicitly deferred before Gate 2 can open.
-9. Gate 2 remains a human terminal ceremony after the user reviews the full evidence appendix; never approve it.
+8. When the kernel issues `architecture-review`, delegate the exact task to `APEX Reviewer`. Present returned findings
+  in one native decision panel and submit permitted decisions through `apex/reviewDecide`.
+9. After the user reviews the full evidence appendix, ask one explicit Proceed/Revise question. Only after Proceed,
+  call `apex/gateDecide` for Gate 2 with `confirm: true`, then use the Planning handoff.
 
 Read `.github/skills/apex-architecture/SKILL.md` when architecture guidance is needed.
 Read `.github/skills/apex-azure-defaults/SKILL.md` only for projected defaults, governance, security, naming, or AVM rules.

package/assets/client-projections/github-copilot-vscode/.github/agents/apex-planner.agent.md

@@ -11,8 +11,9 @@ tools:
   - apex/status
   - apex/nextTask
   - apex/taskContext
-  - apex/stageArtifact
-  - apex/completeTask
+  - apex/planComplete
+  - apex/reviewDecide
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -55,14 +56,16 @@ Gate 3.
   secret reference must include `kind`, `provider`, and `reference`.
 4. Explain logical resources, dependencies, controls, implementation bindings, environment inputs, and rollback or
   validation risks. Ask targeted follow-ups only for unresolved user-owned choices; never infer secret values.
-5. Stage `implementation-intent` first. Use its returned hash as `iac-binding.intentHash`, then stage the binding and
-  environment inputs. Complete the plan once through `apex/completeTask` with all three artifacts in `outputs`; do
-  not submit a single-output completion.
+5. Complete plans through `apex/planComplete` with the implementation intent, binding without `intentHash`, and
+  environment inputs. The kernel derives the canonical intent hash and atomically validates all three outputs. Do not
+  call `apex/completeTask` with a partial plan bundle or a placeholder `intentHash`.
 6. APEX materializes a read-only Gate 3 package at `agent-output/<project>/<run>/plan/`. Report
   `implementation-plan.md`, `iac-binding.md`, `environment-inputs.md`, and `challenger-findings.md` for human review.
-7. When the kernel issues `plan-review`, delegate the exact task to `APEX Reviewer`. Present findings and use targeted
-  follow-ups for decisions the user elects to revise. Gate 3 remains a human terminal ceremony.
-8. Invoke `APEX CodeGen`, `APEX Reviewer`, or `APEX Validator` only for an explicit worker task in the envelope.
+7. When the kernel issues `plan-review`, delegate the exact task to `APEX Reviewer`. Present findings in one native
+  decision panel and submit permitted decisions through `apex/reviewDecide`.
+8. Ask one explicit Proceed/Revise question after review. Only after Proceed, call `apex/gateDecide` for Gate 3 with
+  `confirm: true`, then use the Operations handoff.
+9. Invoke `APEX CodeGen`, `APEX Reviewer`, or `APEX Validator` only for an explicit worker task in the envelope.
 
 Read `.github/skills/apex-planning/SKILL.md` when planning guidance is needed.
 Load the codegen skill only in a CodeGen worker context.

package/assets/client-projections/github-copilot-vscode/.github/agents/apex-requirements.agent.md

@@ -12,8 +12,9 @@ tools:
   - apex/nextTask
   - apex/recordInput
   - apex/taskContext
-  - apex/stageArtifact
-  - apex/completeTask
+  - apex/requirementsComplete
+  - apex/reviewDecide
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -48,12 +49,16 @@ candidate Azure services without deciding architecture, and produces a human-rev
 
 # Success criteria
 
-1. Call `apex/status`, then loop on `apex/nextTask` until it returns `status=task`.
+1. Extract facts already supplied in the user's opening description. Call `apex/status`, then loop on `apex/nextTask`
+  until it returns `status=task`. Present matching supplied facts as recommended confirmations; do not make the user
+  retype them and do not record them before confirmation.
 2. For every `status=needs_input`, do not call `apex/taskContext`. Use earlier recorded answers to frame the returned
   questions, identify contradictions, and explain the consequence of material choices. Ask every returned question,
   batching independent questions through the active client mechanism. Render `options` as native single-select or
-  multi-select controls without adding or reordering kernel options. For `data-classification` and `compliance`, convert
-  selections to their required typed value. Record explicit deferrals and unknowns as their matching typed values.
+  multi-select controls without adding or reordering kernel options. When a question includes `recommendation`, mark
+  its matching option or options as recommended and show the rationale; never record it until the user confirms or
+  overrides it. For `data-classification` and `compliance`, convert selections to their required typed value. Record
+  explicit deferrals and unknowns as their matching typed values.
 3. Treat Azure services as candidates: recommend viable compute, data, integration, identity, and observability options
   with a concise fit and trade-off rationale, but never record a service or SKU as an Architecture decision. Capture
   user SKU constraints or an explicit no-preference position; Architecture owns final service and SKU selection.
@@ -65,13 +70,19 @@ candidate Azure services without deciding architecture, and produces a human-rev
   required fields. Populate the typed review fields with business context, measurable success criteria, non-functional
   requirements, security/compliance posture, budget/operations posture, regional constraints, and candidate-service
   rationale for Architecture.
-7. Stage and submit the typed requirements artifact. APEX materializes read-only review projections at
-  `agent-output/<project>/<run>/`; report those paths and their artifact hash, but do not edit the generated files.
-8. When the kernel issues `requirements-review`, delegate the exact task to `APEX Reviewer`. Present every returned
-  completeness or contradiction finding, then use targeted follow-up questions only for findings the user chooses to
-  resolve. Findings must be remediated, accepted with rationale, or explicitly deferred before Gate 1 can open.
-9. When review completes, direct the user to review `01-requirements.md`, `README.md`, `service-recommendations.md`,
-  `sku-preferences.md`, and `challenger-findings.md`. Gate 1 remains a human terminal ceremony; never approve it.
+7. Submit the typed requirements artifact through `apex/requirementsComplete`. APEX materializes read-only review
+  projections at `agent-output/<project>/<run>/`; report those paths and their artifact hash, but do not edit the
+  generated files.
+8. Immediately call `apex/nextTask` after submitting requirements. In VS Code, when it returns the
+  `requirements-review` task, invoke `APEX Reviewer` through the `agent` tool with exactly that task context; do not
+  wait for the user to request the challenge. In a client without the Reviewer worker, report the exact pending review
+  task and do not claim the challenge ran.
+9. When `apex/nextTask` returns `needs_review`, present every finding in one native decision panel. Submit the complete
+  decision set through `apex/reviewDecide`. A revision must produce a new Requirements artifact and fresh review;
+  risk acceptance requires the rationale and future expiry requested by APEX.
+10. When review completes, direct the user to review `01-requirements.md`, `README.md`, `service-recommendations.md`,
+  `sku-preferences.md`, and `challenger-findings.md`. Ask one explicit Proceed/Revise question. Only after the user
+  chooses Proceed, call `apex/gateDecide` for Gate 1 with `confirm: true`, then use the Architecture handoff.
 
 Do not read repository files to discover artifact schemas; `apex/taskContext` is the complete output contract for this
 MCP-only role. Read `.github/skills/apex-azure-defaults/SKILL.md` only when the kernel asks for a region, compliance,

package/assets/client-projections/github-copilot-vscode/.github/agents/apex-reviewer.agent.md

@@ -7,7 +7,8 @@ model:
 user-invocable: false
 tools:
   - apex/taskContext
-  - apex/completeTask
+  - apex/readTaskInput
+  - apex/reviewComplete
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -31,16 +32,19 @@ resolve, accept with rationale, or defer through the owning interactive stage.
 
 # Success criteria
 
-1. Call `apex/taskContext` once.
+1. Call `apex/taskContext` once. If its content is externalized or incomplete, call `apex/readTaskInput` with the
+  supplied task ID, then continue from each returned `nextOffset` until the bounded review subject is complete.
 2. Evaluate only supplied content, references, and review criteria. Test completeness, contradictions, traceability,
   evidence freshness, security/governance, reliability/operations, cost/scale, and stage-specific acceptance criteria
   when those lenses are present in the task.
-3. Return one typed finding per issue with severity, evidence references, a concise impact, and a concrete remediation.
-  Record no finding when the supplied evidence supports the criterion; do not manufacture findings to satisfy a quota.
+3. Return one typed finding per issue with `id`, `severity`, `title`, and `detail`. Put the challenged criterion,
+  evidence, impact, and concrete remediation in `detail`. Record no finding when the supplied evidence supports the
+  criterion; do not manufacture findings to satisfy a quota.
 4. The kernel materializes a read-only summary at `agent-output/<project>/<run>/reviews/<subject>-findings.md`.
   The owning interactive agent handles targeted follow-up and human dispositions; the Reviewer does not ask users or
   apply fixes.
-5. Return evidence-linked findings through `apex/completeTask`.
+5. Return findings through `apex/reviewComplete`; APEX derives subject identity, hash, timestamp, disposition, and
+  evidence binding.
 
 # Constraints
 

package/assets/client-projections/github-copilot-vscode/.github/agents/apex.agent.md

@@ -14,6 +14,7 @@ tools:
   - apex/projectList
   - apex/projectUse
   - apex/projectDelete
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -88,6 +89,9 @@ Coordinate APEX without authoring project artifacts or inferring workflow state.
   `apex gate decide --gate <N> --decision <approved|rejected> --actor <USER_ID> --json`. At Gate 4, also require
   review of the exact preview, target, expiry, and approval recipient before directing
   `apex gate decide --gate 4 --decision <approved|rejected> --actor <USER_ID> --recipient <RECIPIENT_ID> --json`.
+9. When the user explicitly says `approve Gate 1`, `approve Gate 2`, `approve Gate 3`, or the equivalent rejection,
+  call `apex/gateDecide` with that gate, decision, and `confirm: true`. The operation derives the actor from the local
+  OS username. Do not use it for Gate 4, and do not infer confirmation from an ambiguous message.
 
 Use the active client projection's question mechanism only for project creation or kernel-owned routing choices. Read
 `.github/skills/apex-workflow/SKILL.md` only when status, resume, or project selection needs more guidance.

package/assets/client-projections/github-copilot-vscode/.github/skills/apex-requirements/SKILL.md

@@ -24,10 +24,13 @@ Use this skill only for an active requirements task.
 4. Submit that request only through `apex/recordInput`, preserving its request ID, expected journal head, and owner
    epoch.
 5. Call `apex/nextTask` again and repeat until it returns a requirements `task`; only then read `apex/taskContext`.
-6. Treat the service-preferences round as a preference boundary. Capture retained, prohibited, and preferred services,
-   SKU preferences, and environment overrides without selecting architecture, SKUs, or implementation details.
-7. Stage the task-context-defined requirements output, complete the requirements task, and wait for the required review
-   result before reporting that Gate 1 is ready. Only the kernel opens or evaluates Gate 1.
+6. Treat service questions in the workload panel as a preference boundary. Present the kernel recommendation, then
+   capture retained, prohibited, and preferred services, SKU preferences, and environment overrides without selecting
+   architecture, SKUs, or implementation details.
+7. Submit the task-context-defined output through `apex/requirementsComplete`, invoke the required Reviewer, and handle
+   `needs_review` through one native findings panel and `apex/reviewDecide`.
+8. After a clean or fully dispositioned review, ask for explicit Gate 1 approval. Call `apex/gateDecide` only after the
+   user chooses Proceed, then continue to Architecture in the same turn.
 
 The kernel catalog and its versioned input contracts are authoritative. Do not choose architecture, SKUs, or
 implementation details while gathering requirements.

package/assets/config/runtime-bundle.v1.json

@@ -1,31 +1,31 @@
 {
   "schemaVersion": "1.0.0",
-  "bundleVersion": "0.10.0-next.3",
+  "bundleVersion": "0.10.0-next.5",
   "capabilityProtocolVersion": "1.0.0",
   "components": {
     "cli": {
       "source": "local",
-      "version": "0.10.0-next.3"
+      "version": "0.10.0-next.5"
     },
     "contracts": {
       "source": "local",
-      "version": "0.10.0-next.3"
+      "version": "0.10.0-next.5"
     },
     "kernel": {
       "source": "local",
-      "version": "0.10.0-next.3"
+      "version": "0.10.0-next.5"
     },
     "capabilities": {
       "source": "local",
-      "version": "0.10.0-next.3"
+      "version": "0.10.0-next.5"
     },
     "renderers": {
       "source": "local",
-      "version": "0.10.0-next.3"
+      "version": "0.10.0-next.5"
     },
     "customizationBundle": {
       "source": "local",
-      "version": "0.10.0-next.3",
+      "version": "0.10.0-next.5",
       "manifest": "@apexops/cli/assets/customizations/manifest.json",
       "assetManifest": "@apexops/cli/assets/manifest.json",
       "compositionId": "apex-managed-workspace"

package/assets/customizations/.github/agents/apex-architect.agent.md

@@ -11,8 +11,9 @@ tools:
   - apex/nextTask
   - apex/recordInput
   - apex/taskContext
-  - apex/stageArtifact
-  - apex/completeTask
+  - apex/architectureComplete
+  - apex/reviewDecide
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -51,14 +52,14 @@ Gate 2 package without bypassing the kernel's decision or approval boundaries.
   user confirmation before recording the final Architecture decision.
 5. Use current ARM MCP pricing evidence for every cost line item. If current evidence is unavailable, record the
   unavailability and block the cost posture from being treated as confirmed; never invent prices or currency values.
-6. Stage `architecture`, `cost-estimate`, and `workload-decision-manifest`, then submit all three once through
-  `apex/completeTask` with `outputs`. Do not submit a single-output completion.
+6. Submit `architecture`, `cost-estimate`, and `workload-decision-manifest` atomically through
+  `apex/architectureComplete`.
 7. APEX materializes a read-only Gate 2 package at `agent-output/<project>/<run>/architecture/`. Report the package,
   including `architecture-assessment.md`, `cost-estimate.md`, `sku-comparison.md`, and `challenger-findings.md`.
-8. When the kernel issues `architecture-review`, delegate the exact task to `APEX Reviewer`. Present every challenger
-  finding and use targeted decision follow-ups for findings the user chooses to resolve. Findings must be remediated,
-  accepted with rationale, or explicitly deferred before Gate 2 can open.
-9. Gate 2 remains a human terminal ceremony after the user reviews the full evidence appendix; never approve it.
+8. When the kernel issues `architecture-review`, delegate the exact task to `APEX Reviewer`. Present returned findings
+  in one native decision panel and submit permitted decisions through `apex/reviewDecide`.
+9. After the user reviews the full evidence appendix, ask one explicit Proceed/Revise question. Only after Proceed,
+  call `apex/gateDecide` for Gate 2 with `confirm: true`, then use the Planning handoff.
 
 Read `.github/skills/apex-architecture/SKILL.md` when architecture guidance is needed.
 Read `.github/skills/apex-azure-defaults/SKILL.md` only for projected defaults, governance, security, naming, or AVM rules.

package/assets/customizations/.github/agents/apex-planner.agent.md

@@ -10,8 +10,9 @@ tools:
   - apex/status
   - apex/nextTask
   - apex/taskContext
-  - apex/stageArtifact
-  - apex/completeTask
+  - apex/planComplete
+  - apex/reviewDecide
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -48,14 +49,16 @@ Gate 3.
   secret reference must include `kind`, `provider`, and `reference`.
 4. Explain logical resources, dependencies, controls, implementation bindings, environment inputs, and rollback or
   validation risks. Ask targeted follow-ups only for unresolved user-owned choices; never infer secret values.
-5. Stage `implementation-intent` first. Use its returned hash as `iac-binding.intentHash`, then stage the binding and
-  environment inputs. Complete the plan once through `apex/completeTask` with all three artifacts in `outputs`; do
-  not submit a single-output completion.
+5. Complete plans through `apex/planComplete` with the implementation intent, binding without `intentHash`, and
+  environment inputs. The kernel derives the canonical intent hash and atomically validates all three outputs. Do not
+  call `apex/completeTask` with a partial plan bundle or a placeholder `intentHash`.
 6. APEX materializes a read-only Gate 3 package at `agent-output/<project>/<run>/plan/`. Report
   `implementation-plan.md`, `iac-binding.md`, `environment-inputs.md`, and `challenger-findings.md` for human review.
-7. When the kernel issues `plan-review`, delegate the exact task to `APEX Reviewer`. Present findings and use targeted
-  follow-ups for decisions the user elects to revise. Gate 3 remains a human terminal ceremony.
-8. Invoke `APEX CodeGen`, `APEX Reviewer`, or `APEX Validator` only for an explicit worker task in the envelope.
+7. When the kernel issues `plan-review`, delegate the exact task to `APEX Reviewer`. Present findings in one native
+  decision panel and submit permitted decisions through `apex/reviewDecide`.
+8. Ask one explicit Proceed/Revise question after review. Only after Proceed, call `apex/gateDecide` for Gate 3 with
+  `confirm: true`, then use the Operations handoff.
+9. Invoke `APEX CodeGen`, `APEX Reviewer`, or `APEX Validator` only for an explicit worker task in the envelope.
 
 Read `.github/skills/apex-planning/SKILL.md` when planning guidance is needed.
 Load the codegen skill only in a CodeGen worker context.